DP-203 Secure, monitor, and optimize data storage and data processing Practice Test 6 — 15 Questions

Question 1

You are reviewing an Azure Policy definition. What does this policy do?

Accepted Answer

Denies the creation or update of a storage account if its default blob service version is not set to '2020-10-02'. Option A is correct because the policy denies any storage account that does not have the default service version set to '2020-10-02'. Option B is wrong because it denies, not audits. Option C is wrong because it applies to all storage accounts, not just those with defaultServiceVersion set. Option D is wrong because it does not set the version; it denies if not set.

Answer

Sets the default blob service version of all storage accounts to '2020-10-02'

Answer

Audits storage accounts to check if their default blob service version is set to a value other than '2020-10-02'

Answer

Denies the creation of storage accounts that have the default blob service version set to '2020-10-02'

Question 2

You have an Azure Synapse Analytics dedicated SQL pool that handles both high-priority real-time queries and low-priority batch jobs. You need to ensure that high-priority queries always get the resources they need, while batch jobs do not starve. What should you configure?

Accepted Answer

Create workload groups for high-priority and low-priority queries, assigning appropriate importance and resource percentages. Option C is correct because workload management with workload groups allows you to set importance and resource allocation. Option A is wrong because result-set caching does not prioritize queries. Option B is wrong because materialized views improve performance but do not prioritize. Option D is wrong because data compression reduces storage but does not affect prioritization.

Answer

Enable result-set caching for the high-priority queries

Answer

Enable data compression on the tables used by batch jobs

Answer

Create materialized views for the batch job queries

Question 3

You need to monitor the performance of an Azure Data Factory pipeline that copies data from an on-premises SQL Server to Azure Blob Storage. The pipeline runs on a self-hosted integration runtime. Which metric is most important to monitor to ensure the self-hosted IR is not a bottleneck?

Accepted Answer

Queue depth for the self-hosted IR. Option A is correct because the queue depth indicates how many activities are waiting to be processed, directly showing if the IR is overloaded. Option B is wrong because data read/write measures throughput, not queuing. Option C is wrong because pipeline duration includes all activities. Option D is wrong because connection count does not directly indicate bottleneck.

Answer

Pipeline duration metric

Answer

Number of active connections to the IR

Answer

Data read and data written metrics for the pipeline

Question 4

You are securing an Azure Data Lake Storage Gen2 account that contains sensitive data. Which TWO of the following should you implement to protect data from unauthorized access?

Accepted Answer

Configure ACLs to grant least privilege to users and groups. Option A is correct because private endpoints ensure data traffic does not traverse the public internet. Option C is correct because ACLs provide fine-grained access control at the directory/file level. Option B is wrong because cross-origin resource sharing (CORS) is for web applications, not security. Option D is wrong because a default ACL of 'read' for all authenticated users would grant broad access. Option E is wrong because large file shares are for Azure Files, not ADLS Gen2.

Answer

Set the default ACL to allow read access for all authenticated users

Answer

Enable CORS rules to allow only specific origins

Answer

Enable large file shares on the storage account

Question 5

You are optimizing the performance of an Azure Synapse Analytics dedicated SQL pool. Which THREE of the following actions will most likely improve query performance?

Accepted Answer

Create materialized views for frequently used aggregations. Option A is correct because partitioning large tables can reduce data scanned. Option B is correct because materialized views precompute aggregations. Option D is correct because result-set caching speeds up repeated queries. Option C is wrong because smaller distribution columns can cause data skew. Option E is wrong because converting to heap table is for staging data, not performance optimization.

Answer

Use a smaller distribution column to improve data distribution

Answer

Convert all tables to heap tables to avoid index maintenance

Question 6

You are monitoring an Azure Data Factory pipeline that processes streaming data from Event Hubs to Azure Synapse Analytics. Which TWO Azure Monitor metrics should you set alerts on to detect data loss or processing delays?

Accepted Answer

InputEvents and OutputEvents metrics. Option B is correct because 'InputEvents' and 'OutputEvents' allow you to compare if all events are being processed. Option C is correct because 'Backlogged input events' indicates data is accumulating and not being processed quickly enough. Option A is wrong because 'Data read' and 'Data written' are for copy activities, not streaming. Option D is wrong because 'Duration' is not a streaming metric. Option E is wrong because 'Pipeline run count' is for batch pipelines.

Answer

Duration metric

Answer

Data read and data written metrics

Answer

Pipeline run count metric

Question 7

You are reviewing the ARM template above. The storage account is created with hierarchical namespace enabled (isHnsEnabled: true). After deployment, you need to ensure that the 'data-engineers' group can execute but not read the contents of the root directory. What should you do?

Accepted Answer

Use the Azure portal to set ACLs on the root directory, granting execute permission to the data-engineers group without read permission. Option B is correct because ACLs are the way to set execute permissions at the root directory without granting read. Option A is wrong because RBAC roles at the storage account level grant broad permissions. Option C is wrong because the hierarchical namespace is already enabled. Option D is wrong because firewall rules control network access.

Answer

Modify the ARM template to set the 'isHnsEnabled' property to false and redeploy

Answer

Assign the Storage Blob Data Reader role to the data-engineers group at the storage account level

Answer

Configure a firewall rule to allow only the data-engineers group's IP addresses

Question 8

You are using Azure Data Explorer to monitor real-time sensor data. You run the KQL query shown in the exhibit. What is the purpose of this query?

Accepted Answer

To visualize the count of events every 5 minutes over the last hour. Option B is correct because the query counts events per 5-minute bin and renders a timechart, showing the event frequency over time. Option A is wrong because it does not detect anomalies. Option C is wrong because it does not calculate averages. Option D is wrong because it does not filter specific sensors.

Answer

To detect anomalies in the sensor data

Answer

To calculate the average value of a numeric column over time

Answer

To filter events from a specific sensor

Question 9

You are reviewing an ARM template that assigns a role. What role is being assigned, and at what scope?

Accepted Answer

Storage Blob Data Contributor at the resource group scope. Option A is correct because the roleDefinitionId corresponds to 'Storage Blob Data Contributor', and the scope is the resource group. Option B is wrong because the scope is not the storage account. Option C is wrong because the role is not 'Storage Blob Data Reader' (the GUID is different). Option D is wrong because the scope is the resource group, not subscription.

Answer

Storage Blob Data Owner at the subscription scope

Answer

Storage Blob Data Reader at the resource group scope

Answer

Storage Blob Data Contributor at the storage account scope

Question 10

Your organization uses Azure Synapse Analytics serverless SQL pools to query data in Azure Data Lake Storage Gen2. You need to ensure that only authorized users can access the data via the serverless SQL endpoint, while minimizing administrative overhead. What should you use?

Accepted Answer

Enable Microsoft Entra ID authentication and grant users permissions via Azure RBAC on the storage account.. Option D is correct because Microsoft Entra ID (formerly Azure AD) pass-through authentication allows users to authenticate using their existing Azure AD identities without managing separate SQL logins, reducing overhead. Option A is wrong because storage account keys provide broad access and are not tied to user identities. Option B is wrong because SAS tokens are time-limited and require token management. Option C is wrong because managed identities are for service-to-service authentication, not individual user access.

Answer

Use managed identities for the serverless SQL pool.

Answer

Use storage account access keys for authentication.

Answer

Use shared access signatures (SAS) tokens generated for each user.

Question 11

You are monitoring an Azure Data Factory pipeline that runs daily to load data from an on-premises SQL Server to Azure Synapse Analytics. The pipeline has been failing intermittently with timeout errors. You need to configure alerts to notify the team when the pipeline fails. What is the most efficient way to achieve this?

Accepted Answer

Create an alert rule in Azure Monitor using the 'Pipeline failed runs' metric.. Option B is correct because Azure Monitor alerts on pipeline run metrics can trigger notifications based on failure conditions. Option A is wrong because Azure Log Analytics itself does not send alerts; it stores logs. Option C is wrong because Azure Service Health alerts are for Azure service issues, not pipeline failures. Option D is wrong because Microsoft Defender XDR is for security, not pipeline monitoring.

Answer

Enable diagnostic settings to send pipeline logs to a Log Analytics workspace and create a log search alert.

Answer

Use Azure Service Health alerts to notify when Data Factory is unhealthy.

Answer

Configure Microsoft Defender XDR to monitor pipeline activities.

Question 12

Your company uses Azure Databricks to process large datasets stored in Azure Data Lake Storage Gen2. You need to implement a solution that automatically rotates the storage account access keys every 90 days without interrupting running jobs. The solution should use managed identities where possible. What should you do?

Accepted Answer

Configure Azure Databricks to use a user-assigned managed identity for authentication to Azure Data Lake Storage Gen2.. Option A is correct because using a user-assigned managed identity for Databricks to access storage eliminates the need for access keys. Option B is wrong because key rotation would disrupt jobs that rely on keys. Option C is wrong because SAS tokens with expiry still require token management and rotation. Option D is wrong because storing keys in Key Vault does not prevent job interruption during rotation.

Answer

Use Azure Policy to automatically rotate keys and update Databricks cluster configurations.

Answer

Use Azure Key Vault to store the storage account keys and configure a lifecycle policy to rotate them every 90 days. Update Databricks secrets accordingly.

Answer

Generate a SAS token with a 90-day expiry and update the Databricks secret before expiry.

Question 13

You are designing a data processing solution in Azure Synapse Analytics. The solution must ensure that data at rest in a dedicated SQL pool is encrypted using customer-managed keys (CMK) stored in Azure Key Vault. The encryption should be enabled at the database level. What should you configure?

Accepted Answer

Transparent Data Encryption (TDE) with a customer-managed key in Azure Key Vault.. Option C is correct because Transparent Data Encryption (TDE) with CMK in Azure Key Vault provides database-level encryption with customer-managed keys. Option A is wrong because Always Encrypted is for column-level encryption, not database-level. Option B is wrong because Azure Disk Encryption is for VMs, not SQL pools. Option D is wrong because Azure Purview is for data governance, not encryption.

Answer

Azure Purview data classification and encryption policies.

Answer

Azure Disk Encryption on the nodes hosting the dedicated SQL pool.

Answer

Always Encrypted with keys stored in Azure Key Vault.

Question 14

Your team has deployed an Azure Stream Analytics job that writes output to Azure Cosmos DB. You need to monitor the job for data latency and ensure it meets a service-level agreement (SLA) of under 10 seconds from input to output. Which metric should you track in Azure Monitor?

Accepted Answer

Watermark delay.. Option B is correct because 'Watermark delay' indicates the maximum time between the input event being received and the output being produced. Option A is wrong because 'Input events' shows volume, not latency. Option C is wrong because 'Output events' shows throughput. Option D is wrong because 'Runtime errors' indicates failures.

Answer

Output events.

Answer

Runtime errors.

Answer

Input events.

Question 15

You are optimizing an Azure Synapse Analytics dedicated SQL pool that is experiencing high concurrency and frequent resource class contention. You need to improve query performance and reduce contention without changing the workload. Which two actions should you take? (Choose two.)

Accepted Answer

Implement workload isolation to separate critical queries into dedicated resource groups.. Options B and D are correct. Workload isolation and workload classification help manage resource allocation and reduce contention. Option A is wrong because increasing DWU may help but does not address contention directly. Option C is wrong because result set caching helps read workloads but not contention. Option E is wrong because materialized views improve performance but do not reduce contention.

Answer

Increase the DWU (Data Warehouse Units) to allocate more resources.

Answer

Create materialized views to pre-aggregate data.

Answer

Enable result set caching to reduce repeated query execution.

DP-203 Secure, monitor, and optimize data storage and data processing Practice Test 6 — 15 Questions

Exhibit

DP-203 Secure, monitor, and optimize data storage and data processing Practice Test 6 — 15 Questions

Exhibit